Track over time: has the character of our risk shifted this quarter — attack surface, exploit maturity, severity mix?
The signals compare the second half of the window against the first:
Executive framing: drift > 3pp on any axis is a board-level story about direction of risk, not headcount of CVEs.